CVE-2026-67319 in axios
Summary
by MITRE • 08/01/2026
axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component. While the top-level merged config uses a null prototype, nested plain objects such as auth and paramsSerializer are cloned into ordinary objects and read without own-property checks. When an application passes placeholder nested objects such as auth: {} or paramsSerializer: {}, inherited username/password values can cause silent injection of an Authorization: Basic header, and inherited encode/serialize values can alter query-string serialization (full serializer replacement requires a function-valued pollution primitive). This is exploitable only in the presence of pre-existing prototype pollution.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/01/2026
This vulnerability resides in the axios HTTP client library where improper handling of nested configuration objects creates a path for prototype pollution exploitation to manifest in unexpected ways. The issue affects versions prior to 0.33.0 and 1.x prior to 1.18.0, demonstrating how seemingly benign configuration merging can become a security vector when combined with pre-existing prototype pollution conditions. The core flaw occurs because while the top-level merged configuration correctly employs a null prototype to prevent prototype chain contamination, nested objects like auth and paramsSerializer undergo cloning into regular JavaScript objects without proper own-property checks.
The technical implementation of this vulnerability stems from how JavaScript object property resolution works in conjunction with the library's configuration merging strategy. When developers pass placeholder objects such as auth: {} or paramsSerializer: {}, these empty objects inherit properties from Object.prototype through the standard JavaScript prototype chain. Even though the primary configuration uses null prototype, the nested objects are processed separately and converted to ordinary objects that maintain the standard prototype relationship. This means any pollution of Object.prototype by external components becomes accessible to axios during request processing.
The operational impact of this vulnerability manifests in two primary ways: silent authorization header injection and altered query-string serialization behavior. When prototype pollution has already occurred, inherited username and password properties from polluted prototypes can silently inject Authorization: Basic headers into HTTP requests without the application's knowledge or consent. Additionally, inherited encode/serialize functions from polluted prototypes can completely replace the default query string serialization logic, potentially altering request parameters in ways that could bypass security controls or cause unexpected behavior in API interactions.
This vulnerability aligns with CWE-471 which describes "Modification of Externally-Controllable Data Structure" and maps to ATT&CK technique T1059.007 for "Command and Scripting Interpreter: JavaScript" as it exploits JavaScript's prototype chain mechanisms. The exploitation requires a pre-existing prototype pollution condition, making it a secondary vulnerability that amplifies the impact of primary security flaws rather than standing alone as a direct attack vector. Organizations should ensure their axios dependencies are updated to versions 0.33.0 or 1.18.0 and implement comprehensive prototype pollution detection measures throughout their application stacks. The fix implemented by the axios team addresses this through proper own-property checks during nested object processing, ensuring that only explicitly set properties are considered rather than allowing inherited properties to influence HTTP request behavior.